Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to add a new capture type ?

[Guy Harris <gharris@xxxxxxxxx>]

wuwei@xxxxxxxxxxxxxxx wrote:
> "Windows packet capture library" is used to capture the packet 
> automatically. But I want to change this type of capture.
>
> The packet will be broadcasted to me from another machine. And I have 
> finished the dissector for such packet.
>
> Then how can ethereal get the packet which broadcasted from another 
> machine to dissect.
>
> (I will add a submodule to listen the broadcasting, but how to set the 
> linking between ethereal and this submodule).

Ethereal only supports capturing using

	1) libpcap/WinPcap

or

	2) reading from a FIFO file on UN*X.

This is intentional; a new mechanism for capturing traffic should be 
added to libpcap/WinPcap, so *other* applications can capture traffic 
using it as well.

I assume there's some reason why Ethereal can't just capture the packet 
by capturing on an interface on the network on which the packet is being 
broadcast.